{"id":17657198,"url":"https://github.com/techiescamp/kubernetes-vault","last_synced_at":"2025-05-07T09:27:07.003Z","repository":{"id":42216575,"uuid":"372171635","full_name":"techiescamp/kubernetes-vault","owner":"techiescamp","description":"Kubernetes manifests to setup Hashicorp vault server","archived":false,"fork":false,"pushed_at":"2025-01-28T13:50:58.000Z","size":26,"stargazers_count":21,"open_issues_count":0,"forks_count":30,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-19T20:53:47.576Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/techiescamp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-05-30T09:19:10.000Z","updated_at":"2025-02-24T13:16:52.000Z","dependencies_parsed_at":"2025-02-09T17:41:29.770Z","dependency_job_id":"06213295-1c6e-4b23-b92e-0120fe56410b","html_url":"https://github.com/techiescamp/kubernetes-vault","commit_stats":null,"previous_names":["techiescamp/kubernetes-vault","scriptcamp/kubernetes-vault"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/techiescamp%2Fkubernetes-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/techiescamp%2Fkubernetes-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/techiescamp%2Fkubernetes-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/techiescamp%2Fkubernetes-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/techiescamp","download_url":"https://codeload.github.com/techiescamp/kubernetes-vault/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252849984,"owners_count":21813902,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-23T14:39:28.824Z","updated_at":"2025-05-07T09:27:06.981Z","avatar_url":"https://github.com/techiescamp.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# kubernetes-vault\nKubernetes manifests to setup Hashicorp vault server\n\nFull Documentation: https://devopscube.com/vault-in-kubernetes/\n\n#Sample API request to the vault using service account tokens to acquire a token with reading capabilities for path \"demo-app\"\n\n```\ncurl --request POST --data '{\"jwt\": \"\u003c\u003c service account token of the pod \u003e\u003e\", \"role\": \"webapp\"}' http://192.168.49.2:30493/v1/auth/kubernetes/login\n```\n\n#Sample API request to the vault to fetch secrets at \"demo-app\"\n\n```\ncurl -H \"X-Vault-Token: \u003cclient_token\u003e\" -H \"X-Vault-Namespace: vault\" -X GET http://192.168.49.2:30493/v1/demo-app/data/user01?version=1\n```\n\n## Vault Usage\n\n### Initialize the vault.\n\n```kubectl exec vault-0 -- vault operator init -key-shares=1 -key-threshold=1 -format=json \u003e keys.json\n\nVAULT_UNSEAL_KEY=$(cat keys.json | jq -r \".unseal_keys_b64[]\")\necho $VAULT_UNSEAL_KEY\n\nVAULT_ROOT_KEY=$(cat keys.json | jq -r \".root_token\")\necho $VAULT_ROOT_KEY\n```\n\n### Unseal the vault\n\n```kubectl exec vault-0 -- vault operator unseal $VAULT_UNSEAL_KEY\t```\n\n### Login into the vault\n```kubectl exec vault-0 -- vault login $VAULT_ROOT_KEY```\n\n### Create secrets \n\n```vault secrets enable -version=2 -path=\"demo-app\" kv```\n\n### Create key-value pairs\n```vault kv put demo-app/user01 name=devopscube\nvault kv get demo-app/user01 \n```\n###Create policies\n```vault policy write demo-policy - \u003c\u003cEOH\npath \"demo-app/*\" {\n  capabilities = [\"read\"]\n}\nEOH\n```\n\n### vault policy list\n\n#Enable Kubernetes authentication methods\n```vault auth enable kubernetes\n\nvault write auth/kubernetes/config token_reviewer_jwt=\"$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" kubernetes_host=\"https://$KUBERNETES_PORT_443_TCP_ADDR:443\" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt\n\nvault write auth/kubernetes/role/webapp \\\n        bound_service_account_names=vault \\\n        bound_service_account_namespaces=default \\\n        policies=demo-policy \\\n        ttl=72h\n        ```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftechiescamp%2Fkubernetes-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftechiescamp%2Fkubernetes-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftechiescamp%2Fkubernetes-vault/lists"}